Basic Access Control Research Articles

Collaboration requirements: a point of failure in protecting information

It is sometimes necessary to collaborate with individuals and organizations which should not be fully trusted. Collaborators must be authorized to access information systems some of the data in which, typically, should be withheld. New collaborations require dynamic alterations to security provisions. Solutions based on extending access control to deal with collaborations are either awkward and costly, or unreliable. An alternative approach, complementing basic access control, is results filtering. Content filtering is also costly, but provides a number of benefits not obtainable with access control alone. The most important is that the complexity of setting up and maintaining isolating information cells for every combination of access rights is avoided. New classes of collaborators can be added without requiring a reorganization of the entire information structure. There is no overhead for internal use. Since content of documents, not their labels, is checked, misfiling will not cause inappropriate release. The approach used in the TIHI/SAW projects at Stanford uses simple rules to drive filtering primitives. The filters run on a modest, but dedicated computer managed by a security officer. The rules implement the security policy and balance manual effort and complexity. The functional allocation of responsibilities is good. Result filtering can also be used to implement pure intrusion detection, since it is invisible. The intruder can be given an impression of success, while becoming a target for monitoring or cover stories.

The Design of Metadata Interchange for Chinese Information and Implementation of Metadata Management System

With the development of Internet, digital libraries/museums have received worldwide attention and many developed countries are doing extensive researches on digital libraries/museums. In Taiwan, many institutions have digitized their collections. In addition, major research projects such as Digital Museum Project, Digital Archive Program, Digital Local Document Program, and CMNet are either in progress or about to begin. To digitize resources and present them on the WWW is the first priority; nevertheless, it is more important to organize these resources based on their characteristics, so users may retrieve and use them effectively. In digital library/museum systems, metadata plays a crucial role: its formulation has to begin with understanding the user demands and object characteristics, and standardization is essential for * The work is partially supported by National Science Council under grant NSC 89-2750-P-002-012.

Performance evaluation of a worst case model of the MetaRing MAC protocol with global fairness

The MetaRing is a Medium Access Control (MAC) protocol for high-speed LANs and MANs. The MetaRing MAC protocol offers its users synchronous, and asynchronous types of services and can operate under two basic access control modes: buffer insertion for variable size packets, and slotted for fixed length packets (i.e., cells). The latter mode of operation is considered in this paper, which only reports performance results of an analysis related to the asynchronous type of service. In this paper we propose and solve a specific worst-case model that enables us to calculate quantiles of the queue length distribution at cell departure time as a function of the offered load, and for three different arrival processes: Poisson, Batch Poisson (B-Poisson), and Batch Markov Modulated Poisson Process (BMMPP). The model proposed is a discrete time discrete state Markov chain of M/G/1-Type, and hence we used a matrix analytic methodology to solve it. Exploitation of the structure of the blocks belonging to the transition probability matrix considerably reduces the computational costs. Our results show that the more realistic the arrival process is, the longer the tail of the queue length distribution.

A unified set of proposals for control and design of high speed data networks

In this paper we articulate our philosophy and approach to the design and control of high speed data networks. The object is to put into perspective and to explain the coordination of various isolated pieces of detailed technical analyses that have been reported in several recent papers. In the process we summarize what we have learnt in our recent work and, also, we give indications of the direction of our future work. Our scheme integrates feedback and open loop control. The feedback control is exercised by sliding windows; access controllers regulate bursty sources. All our design proposals are rooted in asymptotic analyses; the justification for asymptotics comes from the largeness of the parameters, such as propagation delay, speed, window size, buffer size, and the number of virtual circuits. This analysis makes a strong case for operating in a specific “moderate usage” regime, and adaptive dynamic windowing algorithms are given that make this happen; moreover, when in this regime, buffers may be sized aggressively small without jeopardizing performance and the simplicity of the retransmission protocol. The topics in the paper are: model of communication, results on the steady-state behavior of the basic model, access control, small buffers and retransmission protocols, dynamic adaptive windows, bursty sources, and contrast with previous work.